Where. scripts/ci/release-cache-contract.test.mjs, readSiblingWithInputs: the with key matcher runs against line.raw rather than the comment-stripped line used everywhere else in the scanner. Found during the independent verification on PR #2412; fail-closed, so recorded here rather than fixed in that PR.
Effect. A step written as
- uses: actions/setup-node@v7
with: # inputs below
cache: npm
cache-dependency-path: package-lock.jsonmakes the matcher capture # inputs below as the with value. cleanScalar strips only whitespace-preceded #..., and after trim() the # is at index 0, so the value reads non-empty and the scanner reports with must use a block mapping, not an inline scalar or flow mapping on a perfectly ordinary edit. Confusing red, not a bypass.
Fix. Match with against stripYamlComment(line.raw) (or strip a leading # comment in cleanScalar), add a fixture with a trailing comment on with: that must pass, and keep the existing block-mapping rejection for a real inline value. One line plus one test; belongs with CI-09 #2333.
Also noted, unverified. It is unproven that GitHub Actions' own parser accepts !!str on a workflow key at all. The scanner now rejects tags on any key and on with values regardless, so this does not change the contract, but if someone wants to close the question a throwaway branch workflow answers it in one run.
Where.
scripts/ci/release-cache-contract.test.mjs,readSiblingWithInputs: thewithkey matcher runs againstline.rawrather than the comment-stripped line used everywhere else in the scanner. Found during the independent verification on PR #2412; fail-closed, so recorded here rather than fixed in that PR.Effect. A step written as
makes the matcher capture
# inputs belowas thewithvalue.cleanScalarstrips only whitespace-preceded#..., and aftertrim()the#is at index 0, so the value reads non-empty and the scanner reportswith must use a block mapping, not an inline scalar or flow mappingon a perfectly ordinary edit. Confusing red, not a bypass.Fix. Match
withagainststripYamlComment(line.raw)(or strip a leading#comment incleanScalar), add a fixture with a trailing comment onwith:that must pass, and keep the existing block-mapping rejection for a real inline value. One line plus one test; belongs with CI-09 #2333.Also noted, unverified. It is unproven that GitHub Actions' own parser accepts
!!stron a workflow key at all. The scanner now rejects tags on any key and onwithvalues regardless, so this does not change the contract, but if someone wants to close the question a throwaway branch workflow answers it in one run.